humanish 0.134.0 → 0.136.0

package/CHANGELOG.md

@@ -8,6 +8,36 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.136.0: verify takes less than half the time on large runs (2026-10-14)
+
+humanish 0.136.0 makes `humanish verify` take less than half the time on large runs. It checks a
+run folder for links 32 entries at a time and inflates screenshots on Node's thread pool, 1 MiB of
+rows at a time, and still runs every check it ran before. On a run folder of 15,000 entries verify
+took 3.3 seconds where it took 7.7, and on a run with 3,000 real screenshots 4.2 seconds where it
+took 10.3. A computer-use participant that repeats a base64- or percent-encoded key from its
+instructions no longer makes the run `blocked`. `humanish analyze` names the participant and the
+event id when two run events share an id, and reports `ANALYSIS_SOURCE_INVALID` where it reported
+`ANALYSIS_UNAVAILABLE`. The bundle estimate counts participants' instructions and task goals with
+the mission, `init` prints three next steps in 24 lines, and reading a run refuses a conversation
+without its requests list.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.136.0)
+
+## 0.135.0: Encoded keys in a study's own text stay out of the run (2026-10-14)
+
+humanish 0.135.0 keeps a base64- or percent-encoded key in a study's own text out of the copies of
+that text the run records. The run redacted keys as written, and verify also decodes those
+encodings, so a study whose title, mission, instructions, persona or scripted scenario held an
+encoded key produced a run graded `blocked`. A participant that repeats such a key in its own words
+still does (#1892). `actor.model`, `subject.envValues` and the analysis question now refuse such a
+value before anything runs, which a study that ran before may now meet. verify's per-file scan also
+finds a key behind an HTML reference and a JSON escape. The Observer page and its live feed carry
+each participant's items on their own, so `humanish observe` writes the page of a run whose traces
+together pass V8's longest string: on a synthetic run of 25 participants with 30 MiB traces it
+exits 0 where it exited 2.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.135.0)
+
 ## 0.134.0: Participants held to an end keep reloading until it (2026-10-14)
 
 humanish 0.134.0 keeps a participant held to a scheduled end running when it reloads a page that

package/dist/actors/computer-use/loop/session.js

@@ -1,3 +1,4 @@
+import { redactEncodedText } from "../../../evidence/encoded-text.js";
 import { TaskTracker } from "../../../study/tasks.js";
 import { StreakRecord } from "./streak.js";
 import { TraceRecorder } from "./trace.js";
@@ -124,9 +125,13 @@ export class LoopSession {
     }
     // Model-authored narration: literal-scrub known provisioned values, then pattern-redact.
     // A value the model transcribes (a DB password it read on screen) has no shape, so redactText
-    // alone cannot catch it; the run's scrubKnownValues, injected as scrubText, closes that.
+    // alone cannot catch it; the run's scrubKnownValues, injected as scrubText, closes that. The
+    // participant receives its instructions as written, so it can repeat a key the study wrote
+    // base64- or percent-encoded, which verify decodes; redactEncodedText removes that one too.
+    // The known values are scrubbed again last: a marker written before other text can spell one,
+    // as `[REDACTED_SECRET] and` spells `SECRET] and`.
     redactNarration(text) {
-        return this.settings.redaction.redactText(this.scrubText(text));
+        return this.scrubText(redactEncodedText(this.settings.redaction.redactText(this.scrubText(text))));
     }
     /** Hand a watcher the trace so far with the running usage, without waiting on it. */
     flush() {

package/dist/actors/scripted-browser/actor.js

@@ -124,7 +124,7 @@ export async function runScriptedBrowserSessionInPreparedRoot(options, preparedA
         browser = await launch({ browserCommand, timeoutMs: options.timeoutMs });
     }
     catch (error) {
-        const reason = `Scripted browser launch failed: ${compactBrowserError(error)}`;
+        const reason = `Scripted browser launch failed: ${compactBrowserError(error, scrub)}`;
         const capture = await persistScriptedFailureCapture({
             appUrl: options.appUrl,
             artifactRoot: preparedArtifactRoot,
@@ -196,7 +196,7 @@ async function runScriptedJourney(args) {
     const started = Date.now();
     const deadline = started + args.timeoutMs;
     const tracePath = tracePathForBrowserSurface(args.surface);
-    const httpProbe = await probeAppUrl(args.appUrl, Math.min(args.timeoutMs, 15_000));
+    const httpProbe = await probeAppUrl(args.appUrl, Math.min(args.timeoutMs, 15_000), args.scrub);
     let page = null;
     const steps = [];
     let executedSteps = 0;
@@ -230,7 +230,7 @@ async function runScriptedJourney(args) {
         await assertScriptedOutputRoot(args.artifactRoot);
         timedOut = error instanceof ScriptedJourneyTimeoutError;
         const now = new Date().toISOString();
-        const reason = compactBrowserError(error);
+        const reason = compactBrowserError(error, args.scrub);
         if (steps.length === 0) {
             steps.push(...buildBlockedBrowserPersonaSteps({
                 browserJourney: args.journey,

package/dist/actors/scripted-browser/steps.d.ts

@@ -53,10 +53,17 @@ export declare function buildBrowserTrace(args: {
     surface: BrowserSurface;
 }): Record<string, unknown>;
 export declare function sanitizeBrowserEvidenceUrl(value: string, urlPolicy?: ScriptedBrowserEvidenceUrlPolicy): string;
-export declare function probeAppUrl(appUrl: string, timeoutMs: number): Promise<{
+export declare function probeAppUrl(appUrl: string, timeoutMs: number, scrubKnown: (text: string) => string): Promise<{
     ok: boolean;
     reason: string;
     status?: number;
 }>;
 export declare function normalizeLocalAppUrl(value: string): string | null;
-export declare function compactBrowserError(error: unknown): string;
+/**
+ * A browser error as a step records it, cut to 240 characters. It can quote the step's selector or
+ * URL, which the scenario wrote and the browser received as written, so keys are redacted as
+ * written and in the encoded forms verify decodes. The run's known values are scrubbed between
+ * the two passes, so the encoded pass cannot cut one apart before its scrub reads it. The cut
+ * comes last, so it cannot split a value either pass would find.
+ */
+export declare function compactBrowserError(error: unknown, scrubKnown: (text: string) => string): string;

package/dist/actors/scripted-browser/steps.js

@@ -4,6 +4,7 @@
 import { mkdtemp, rm } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { assertScreenshotEvidence, stripPngMetadataChunks } from "../../evidence/image.js";
 import { digestText, redactToSecretLabel } from "../../evidence/redaction.js";
 import { assertPreparedSelectedOutputDirectory, assertSafeOutputPathSegment, prepareContainedOutputFile, prepareSelectedOutputDirectory, readContainedRegularFile, refusalText, RUN_ARTIFACT_MAX_BYTES, writeContainedOutputFile, } from "../../run/contained-output.js";
@@ -94,7 +95,7 @@ export async function executeBrowserPersonaStep(args) {
     const screenshotPath = screenshotPathForBrowserStep(args.surface, args.step);
     await prepareContainedOutputFile(args.absoluteArtifactRoot, screenshotPath);
     const screenshotBytes = await captureScriptedPageScreenshot(args.page);
-    assertScreenshotEvidence(screenshotPath, screenshotBytes);
+    await assertScreenshotEvidence(screenshotPath, screenshotBytes);
     await writeContainedOutputFile(args.absoluteArtifactRoot, screenshotPath, screenshotBytes);
     const assertions = await evaluateBrowserStepExpectations({
         afterState,
@@ -233,7 +234,7 @@ export async function captureBlockedStepScreenshot(page, artifactRoot, surface,
     }
     try {
         const screenshotBytes = await captureScriptedPageScreenshot(page);
-        assertScreenshotEvidence(screenshotPath, screenshotBytes);
+        await assertScreenshotEvidence(screenshotPath, screenshotBytes);
         await writeContainedOutputFile(artifactRoot, screenshotPath, screenshotBytes);
         return { screenshotPath, written: true };
     }
@@ -333,7 +334,7 @@ export function sanitizeBrowserEvidenceUrl(value, urlPolicy = LOOPBACK_EVIDENCE_
         return evidenceOrigin;
     }
 }
-export async function probeAppUrl(appUrl, timeoutMs) {
+export async function probeAppUrl(appUrl, timeoutMs, scrubKnown) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
@@ -349,7 +350,7 @@ export async function probeAppUrl(appUrl, timeoutMs) {
     catch (error) {
         return {
             ok: false,
-            reason: compactBrowserError(error),
+            reason: compactBrowserError(error, scrubKnown),
         };
     }
     finally {
@@ -375,11 +376,18 @@ export function normalizeLocalAppUrl(value) {
         return null;
     }
 }
-export function compactBrowserError(error) {
-    if (error instanceof Error) {
-        return redactSensitiveText(error.message).replace(/\s+/g, " ").slice(0, 240);
-    }
-    return redactSensitiveText(String(error)).replace(/\s+/g, " ").slice(0, 240);
+/**
+ * A browser error as a step records it, cut to 240 characters. It can quote the step's selector or
+ * URL, which the scenario wrote and the browser received as written, so keys are redacted as
+ * written and in the encoded forms verify decodes. The run's known values are scrubbed between
+ * the two passes, so the encoded pass cannot cut one apart before its scrub reads it. The cut
+ * comes last, so it cannot split a value either pass would find.
+ */
+export function compactBrowserError(error, scrubKnown) {
+    const text = error instanceof Error ? error.message : String(error);
+    return redactEncodedText(scrubKnown(redactToSecretLabel(text)))
+        .replace(/\s+/g, " ")
+        .slice(0, 240);
 }
 function browserScreenshotBytes(value) {
     if (Buffer.isBuffer(value)) {
@@ -415,6 +423,3 @@ async function captureScriptedPageScreenshot(page) {
             .catch(() => undefined);
     }
 }
-function redactSensitiveText(text) {
-    return redactToSecretLabel(text);
-}

package/dist/analysis/automatic-config.js

@@ -3,7 +3,7 @@ import { DEFAULT_ANALYSIS_MAX_OUTPUT_TOKENS, MAX_ANALYSIS_OUTPUT_TOKENS, analysi
 import { admissionRule } from "./admission.js";
 import { analysisRequestCount, EVIDENCE_LIMITS } from "./analysis-limits.js";
 import { plural } from "../run/text.js";
-import { containsSensitive } from "../evidence/redaction.js";
+import { scanEncodedText } from "../evidence/encoded-text.js";
 export const DEFAULT_ANALYSIS_TIMEOUT_MS = 600_000;
 const MAX_ANALYSIS_TIMEOUT_MS = 600_000;
 export const DEFAULT_ANALYSIS_MODEL = "gpt-6-astra";
@@ -21,6 +21,8 @@ const validTimeout = (value) => typeof value === "number" &&
     value <= MAX_ANALYSIS_TIMEOUT_MS;
 /** An absent question is valid; a present one must be a string of at most 4000 characters. */
 const validQuestion = (value) => value === undefined || (typeof value === "string" && value.length <= 4000);
+// The provider receives the question and analysis.json keeps it. verify reads that file as written
+// and decoded, so the question is refused when scanEncodedText reads a secret in it.
 const SENSITIVE_QUESTION = {
     ok: false,
     message: "review.analysis.question contains sensitive text and cannot be sent for analysis.",
@@ -60,7 +62,7 @@ export function resolveAutomaticAnalysis(raw) {
                 message: `Codex analysis requires the qualified ${CODEX_ANALYSIS_MODEL} model and timeoutMs 1–${MAX_ANALYSIS_TIMEOUT_MS}. Dollar and output-token caps are unavailable; omit them. The optional question is limited to 4000 characters.`,
             };
         }
-        if (question !== null && containsSensitive(question))
+        if (question !== null && scanEncodedText(question).sensitive)
             return SENSITIVE_QUESTION;
         return {
             ok: true,
@@ -99,7 +101,7 @@ export function resolveAutomaticAnalysis(raw) {
             message: `review.analysis requires a positive maxCostUsd up to 1000, a supported analysis model, timeoutMs 1–${MAX_ANALYSIS_TIMEOUT_MS}, maxOutputTokens 256–${MAX_ANALYSIS_OUTPUT_TOKENS}, and an optional question of at most 4000 characters.`,
         };
     }
-    if (question !== null && containsSensitive(question))
+    if (question !== null && scanEncodedText(question).sensitive)
         return SENSITIVE_QUESTION;
     return {
         ok: true,

package/dist/analysis/evidence-sources.js

@@ -1,9 +1,10 @@
 import { receivingAnalysisContext } from "../comms/receiving-evidence.js";
-import { eventRecordIdOf, recordIdOf, streamParticipantIdOf } from "../run/participant-records.js";
+import { streamParticipantIdOf } from "../run/participant-records.js";
 import { cuaEndpointSource } from "../actors/goal-source.js";
 import { isRecord } from "../run/type-guards.js";
 import { ACTION_CAPTURE_VERSION, } from "./types.js";
 import { decodesToPlainRelativePath, isEvidencePath } from "../run/evidence-files.js";
+import { isRunEventOf } from "./source.js";
 // How a run bundle becomes analysis sources: each participant's recorded provenance and assignment,
 // the evidence entries its trace offers, and the order in which entries are admitted under the
 // count and byte budgets. captureEvidence selects from these, taking each participant's while its
@@ -97,8 +98,7 @@ export function participantSource(stream, captureVersion) {
         },
     };
 }
-const runEventsOf = (bundle, stream) => bundle.events.filter((entry) => entry.streamId === stream.id ||
-    (entry.streamId === undefined && eventRecordIdOf(entry) === recordIdOf(stream)));
+const runEventsOf = (bundle, stream) => bundle.events.filter((event) => isRunEventOf(stream, event));
 /**
  * How many entries sourceEntries gives of run.json's `stream` once its trace is loaded, counted
  * before the trace is read: the trace loader refuses a trace that does not hold the item count its
@@ -163,11 +163,8 @@ export function sourceEntries(bundle, stream, captureVersion) {
             failed: ["failed", "blocked", "timed_out"].includes(item.status ?? ""),
         });
     }
-    const runEventIds = new Set();
+    // parseAnalysisSource refuses a run.json in which two of a participant's run events share an id.
     for (const event of runEventsOf(bundle, stream)) {
-        if (runEventIds.has(event.id))
-            throw new Error("ANALYSIS_SOURCE_EVENT_DUPLICATE");
-        runEventIds.add(event.id);
         entries.push({
             eventId: event.id,
             kind: `run_event:${event.type}`,

package/dist/analysis/evidence.js

@@ -46,8 +46,8 @@ export async function captureEvidence(prepared, bundleBytes, requested = {}) {
     // Admission stops at a participant's evidence share. The shares come from run.json's counts, so
     // only the first share of each participant's entries in admission order is kept of its trace.
     const shares = evidenceShares(bundle, limits, captureVersion);
-    // A participant past limits.participants has its trace read and checked by the loader, and gives
-    // no entries, so nothing in its run events or items can refuse the participants that are kept.
+    // A participant past limits.participants has its trace read and checked like the others' and
+    // gives no entries.
     const sources = await readParticipantTraces(prepared, bundle, (stream, index) => index < limits.participants
         ? participantSources(bundle, bundle.streams[index], stream, captureVersion, {
             evidenceShare: shares[index],
@@ -229,7 +229,7 @@ async function selectCaptures(prepared, packings, sel, omissions) {
             const bytes = result.state === "read" ? result.bytes : null;
             sel.returnedImageBytes += bytes?.length ?? 0;
             packing.readBytes += bytes?.length ?? 0;
-            if (bytes === null || screenshotEvidenceError(source.capturePath, bytes) !== null) {
+            if (bytes === null || (await screenshotEvidenceError(source.capturePath, bytes)) !== null) {
                 omissions.add("Some captures were missing, unsafe, oversized, or invalid PNG evidence.");
                 continue;
             }
@@ -453,7 +453,7 @@ export async function validateAnalysisEvidence(prepared, artifact, bundleBytes)
             let hash = checkedCaptures.get(source.capturePath);
             if (hash === undefined) {
                 const bytes = await readBoundedFile(prepared, source.capturePath, EVIDENCE_LIMITS.imageBytes);
-                if (!bytes || screenshotEvidenceError(source.capturePath, bytes) !== null)
+                if (!bytes || (await screenshotEvidenceError(source.capturePath, bytes)) !== null)
                     throw new Error("ANALYSIS_CAPTURE_UNAVAILABLE");
                 checkedImageBytes += bytes.length;
                 if (checkedImageBytes > imageByteLimit)

package/dist/analysis/execute.js

@@ -4,6 +4,7 @@ import { estimateAnalysisCost } from "./admission.js";
 import { createHash, randomUUID } from "node:crypto";
 import { MODEL_RATES } from "../run/pricing.js";
 import { containsSensitive } from "../evidence/redaction.js";
+import { scanEncodedText } from "../evidence/encoded-text.js";
 import { ANALYSIS_ID_PATTERN, ANALYSIS_SCHEMA, } from "./types.js";
 import { INPUT_IMAGE_DATA_URL, createAnalysisProvider, } from "./provider.js";
 import { hashAnalysisValue, analysisResultJsonSchema, validateAnalysisInputMetadata, } from "./validation.js";
@@ -189,7 +190,7 @@ export function estimateAnalysisAdmission(input, config) {
             (typeof config.question !== "string" || config.question.length > 4000))) {
         return denied("analysis_config_invalid");
     }
-    if (config.question !== null && containsSensitive(config.question))
+    if (config.question !== null && scanEncodedText(config.question).sensitive)
         return denied("analysis_question_sensitive");
     const badInput = inputError(input);
     if (badInput)

package/dist/analysis/service.js

@@ -5,6 +5,7 @@ import { lstat, mkdir, realpath, rmdir } from "node:fs/promises";
 import path from "node:path";
 import { renderObserver } from "../observer/render.js";
 import { containsSensitive } from "../evidence/redaction.js";
+import { scanEncodedText } from "../evidence/encoded-text.js";
 import { transientCommsKnownValueScrub } from "../run/transient-comms-secrets.js";
 import { verifyRunPrepared } from "../verify/verify.js";
 import { loadRunBundlePrepared, resolveRunPath } from "../run/locate.js";
@@ -189,7 +190,7 @@ function analyzeConfigRefusal(config) {
         ? !validCodexAnalysisConfig(config)
         : !Number.isFinite(config.maxCostUsd) || config.maxCostUsd <= 0 || config.maxCostUsd > 1000)
         return "ANALYSIS_CONFIG_INVALID";
-    if (config.question !== null && containsSensitive(config.question))
+    if (config.question !== null && scanEncodedText(config.question).sensitive)
         return "ANALYSIS_QUESTION_UNSAFE";
     return null;
 }

package/dist/analysis/source.d.ts

@@ -1,6 +1,6 @@
-import { type StoredRunBundle } from "../run/bundle.js";
+import { type RunEvent, type StoredRunBundle } from "../run/bundle.js";
 import { type PreparedRunArtifactPaths } from "../run/paths.js";
-import type { RunStream } from "../run/streams.js";
+import type { RunStream, StoredRunStream } from "../run/streams.js";
 /**
  * A refusal of the run's recorded source. Its message is the code, as every analysis error's is,
  * and `reason` says which file analysis did not read and why, for the person who asked.
@@ -11,10 +11,13 @@ export declare class AnalysisSourceRefusedError extends Error {
 }
 /** The refusal of a run.json of `size` bytes, more than the `max` analysis reads of it. */
 export declare function runFileTooLarge(size: number | bigint, max: number): AnalysisSourceRefusedError;
+/** Whether `event` is `stream`'s: it names the stream, or no stream and the stream's record. */
+export declare const isRunEventOf: (stream: StoredRunStream, event: RunEvent) => boolean;
 /**
  * run.json's bundle, when it is a run bundle of the prepared run that analysis reads: at most
- * EVIDENCE_LIMITS.sourceBytes, at most EVIDENCE_LIMITS.participants participants, and each
- * participant and event with the fields analysis reads.
+ * EVIDENCE_LIMITS.sourceBytes, at most EVIDENCE_LIMITS.participants participants, each
+ * participant and event with the fields analysis reads, and no two run events of one participant
+ * with one id.
  */
 export declare function parseAnalysisSource(prepared: PreparedRunArtifactPaths, bytes: Buffer): StoredRunBundle;
 /**

package/dist/analysis/source.js

@@ -2,6 +2,7 @@
 // and the refusals it gives for either.
 import { isCommsReceivingEvidence } from "../comms/receiving-evidence.js";
 import { isReadRunBundleSchema } from "../run/bundle.js";
+import { eventRecordIdOf, recordIdOf } from "../run/participant-records.js";
 import { runIdOf } from "../run/paths.js";
 import { reduceRunTraces, StreamTraceRefusedError, StreamTraceTooLargeError, } from "../run/stream-trace.js";
 import { isRecord } from "../run/type-guards.js";
@@ -24,12 +25,16 @@ const runFileInvalid = (reason) => new AnalysisSourceRefusedError("ANALYSIS_SOUR
 const traceInvalid = (streamId, reason) => new AnalysisSourceRefusedError("ANALYSIS_SOURCE_INVALID", `Analysis did not read participant ${streamId}'s trace: ${reason}`);
 /** The refusal of a run.json of `size` bytes, more than the `max` analysis reads of it. */
 export function runFileTooLarge(size, max) {
-    return new AnalysisSourceRefusedError("ANALYSIS_SOURCE_TOO_LARGE", `Analysis did not read run.json: it holds ${bytes(size)}, more than the ${limit(max)} analysis reads of it. run.json grows with each participant and the study's mission; split the participants across studies to keep it under the limit.`);
+    return new AnalysisSourceRefusedError("ANALYSIS_SOURCE_TOO_LARGE", `Analysis did not read run.json: it holds ${bytes(size)}, more than the ${limit(max)} analysis reads of it. run.json grows with each participant, its instruction, the mission and the task goals; split the participants across studies to keep it under the limit.`);
 }
+/** Whether `event` is `stream`'s: it names the stream, or no stream and the stream's record. */
+export const isRunEventOf = (stream, event) => event.streamId === stream.id ||
+    (event.streamId === undefined && eventRecordIdOf(event) === recordIdOf(stream));
 /**
  * run.json's bundle, when it is a run bundle of the prepared run that analysis reads: at most
- * EVIDENCE_LIMITS.sourceBytes, at most EVIDENCE_LIMITS.participants participants, and each
- * participant and event with the fields analysis reads.
+ * EVIDENCE_LIMITS.sourceBytes, at most EVIDENCE_LIMITS.participants participants, each
+ * participant and event with the fields analysis reads, and no two run events of one participant
+ * with one id.
  */
 export function parseAnalysisSource(prepared, bytes) {
     if (bytes.length > EVIDENCE_LIMITS.sourceBytes)
@@ -67,7 +72,20 @@ export function parseAnalysisSource(prepared, bytes) {
             typeof event.type !== "string")
             throw runFileInvalid(`event ${index + 1} needs an id, a type and a message.`);
     }
-    return value;
+    const bundle = value;
+    for (const stream of bundle.streams) {
+        // The place each id was first seen, since an analysis cites a participant's run event by its id.
+        const firstPlace = new Map();
+        for (const [index, event] of bundle.events.entries()) {
+            if (!isRunEventOf(stream, event))
+                continue;
+            const first = firstPlace.get(event.id);
+            if (first !== undefined)
+                throw runFileInvalid(`events ${first + 1} and ${index + 1} are participant ${stream.id}'s and share the id ${JSON.stringify(event.id)}, and analysis cites each of a participant's run events by its id. Give one of them another id in run.json; if run.json was not edited, please report this as a bug.`);
+            firstPlace.set(event.id, index);
+        }
+    }
+    return bundle;
 }
 /**
  * What `keep` takes from each stream of run.json's bundle with the stream's trace loaded, in stream

package/dist/cli/commands/setup.js

@@ -395,12 +395,14 @@ function formatInitHuman(result) {
     const lines = [title, `cwd: ${result.cwd}`];
     if (result.ok && result.mode === "applied") {
         // Name each file init wrote, so the person or agent who ran it can review exactly those
-        // files; directories and preserved files are counts. JSON always carries every change.
+        // files; files it left alone are a count. Neither includes the empty runtime directories under
+        // the ignored `.humanish/`: they give the reader nothing to review, leaving them out keeps a
+        // first setup with three next steps to 24 lines, and a second run then counts as unchanged
+        // the files the first one named. JSON always carries every change.
         const files = (action) => result.changes.filter((change) => change.action === action && change.target !== "runtime");
         const created = files("create");
         const updated = files("update");
-        const preserved = result.changes.filter((change) => change.action === "skip").length;
-        const directories = result.changes.filter((change) => change.action === "mkdir").length;
+        const preserved = files("skip").length;
         lines.push("");
         if (created.length > 0)
             lines.push("created:", ...created.map((change) => `  ${change.path}`));
@@ -408,13 +410,8 @@ function formatInitHuman(result) {
             lines.push("updated:", ...updated.map((change) => `  ${change.path} (${change.reason})`));
         if (created.length === 0 && updated.length === 0)
             lines.push("no files changed");
-        if (preserved > 0 || directories > 0)
-            lines.push([
-                ...(preserved > 0 ? [`${plural(preserved, "existing path")} unchanged`] : []),
-                ...(directories > 0
-                    ? [`${plural(directories, "ignored directory", "ignored directories")} prepared`]
-                    : []),
-            ].join(", "));
+        if (preserved > 0)
+            lines.push(`${plural(preserved, "existing path")} unchanged`);
     }
     else {
         lines.push("", "changes:", ...result.changes.map(formatInitChange));

package/dist/evidence/encoded-text.d.ts

@@ -8,10 +8,12 @@ export declare const latin1RunsAsUtf8: (text: string) => string;
 export declare function decodeEscapes(text: string): string;
 /**
  * Every reading of the text a scan matches, each once: as written, decodeEscapes, with percent
- * escapes read as UTF-8, decodeEscapes with transfer escapes expanded, and the text as written and
+ * escapes read as UTF-8, decodeEscapes with transfer escapes expanded, the text as written and
  * decoded with each run of U+0080 to U+00FF characters read as UTF-8 bytes, which undoes text that
- * a reader already decoded one byte per character. Either percent reading can split a value that
- * the other keeps whole, as `%E2%80%80` (U+2000, a space, in UTF-8) does.
+ * a reader already decoded one byte per character, decodeEscapes with HTML references left as
+ * written and that reading with transfer escapes expanded, and the text with only HTML references
+ * decoded. Either percent reading can split a value that the other keeps whole, as `%E2%80%80`
+ * (U+2000, a space, in UTF-8) does.
  */
 export declare function readingsOf(text: string): string[];
 /** How scanEncodedText reads text. */
@@ -34,6 +36,14 @@ export interface EncodedTextScan {
  * is opaque unless the caller allows opaque runs.
  */
 export declare function scanEncodedText(text: string, options?: EncodedTextScanOptions, depth?: number): EncodedTextScan;
+/**
+ * redactText, then each whitespace-separated piece that scanEncodedText reads as sensitive replaced
+ * by the secret marker, so a key written in base64 or percent-encoded goes as a literal one does.
+ * When the pieces read clean one at a time but the text still reads sensitive, as `Bearer` before a
+ * percent-encoded token does, the whole text becomes the marker. For study text the run records and
+ * the instructions composed from it: on 32 KiB of prose it took 3 ms, and 34 ms with a key in it.
+ */
+export declare function redactEncodedText(text: string): string;
 /**
  * scanEncodedText, cached in this process. The key is the sha256 of the scanned string's UTF-16
  * code units, the options and ENCODED_SCAN_VERSION. Encoding as UTF-16LE keeps every code unit,